PT-2026-34653 · Unknown · Labone Web Server

Published 2026-04-23 · Updated 2026-04-23 · CVE-2026-6903

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LabOne Web Server (affected versions not specified)

Description The LabOne Web Server, which supports the LabOne User Interface, has insufficient input validation in its file access functionality. This allows an unauthenticated attacker to read arbitrary files on the host system that the operating system user running the software can access. Furthermore, the server does not sufficiently restrict cross-origin requests, enabling a remote attacker to trigger file access from a victim's browser via a malicious website. This issue is only present when the LabOne Web Server is active; installations using only the LabOne APIs are not affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Origin Validation Error

Weakness Enumeration

CWE-22

CWE-346

Related Identifiers

CVE-2026-6903

Affected Products

Labone Web Server

References · 4

• https://zhinst.com/support/security/2026/zi-sa-2026-001 · Vendor Advisory
• https://zhinst.com/support/download-center · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-6903 · Security Note
• https://twitter.com/CVEnew/status/2047359862883881430 · Twitter Post